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performing data staging at predetermined time 
intervals; anc' 

updating the calling profile cube by generating a 
snapshot dube from a call table; and 
merging tha snapshot cube with the calling profile 
cube to generate an updated calling profile cube. 

24. The method of\claim 28 whereia the calling profile 
cube has a cell thaA includes a probability distribution 
value based on one oi\ the probability distribution on 
calls to each callee and the probability distribution on 
all calls. 



25. The method of claim\22 wherein the dimensions include 
a day-of-week hierarchy, a time hierarchy, and a duration 
hierarchy. 



Please add the following new claims: 




as 



(New) A method for detecting 

telecommunication fraud performed in a data processing 
system ^having a data warehouse and an OLAP server, the 
method comprising; 

retrie^ng a plurality of call records from the data 
warehouse; 

generating \ calling profile cube based on the call 
records; \wherein the calling profile cube 
includes information on multiple customers; 
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retrieving records* from the profile table and based 

i 

thereon generating a profile cube representing 
the records frlom the profile table, said profile 
-cube having predetermined dimensions that are 
the same as the\ dimensions of the snapshot cube; 

merging the snapshot \cube and the profile cube to 
generate an updated profile cube; and 

deriving the volume-baused calling pattern cubes based 
on the updated profile cube, 



3. A method as in claim 27\ wherein the step of when the 
volume-based calling patteWn cube is in a first 
predetermined relationship wrath predetermined fraudulent 
volume-based calling pattern, \ performing a first action 
includes one of: 

flagging a particular callet with the volume-based 

calling pattern being analyzed as suspicious; 
automatically generating an avLert that specifies 

callers with suspicious vplume-based calling 

pattern; 

performing further investigatioh on callers with 
suspicious volume-based calVLing pattern; 

cancellation of telephone services for callers with 
suspicious volume-based calling pattern; and 

performing other appropriate remecw_al actions. 
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A method as in claim 1 further comprising: 
analyzing trie calling pattern cube by utilizing at 
least one OLAP operation. 



6. A method as in claim 27 wherein the predetermined 

\ 

fraudulent volume-based calling pattern in one of a 
personalized callingXpattern and a group-based pattern. 



A method as in claim 2 further comprising: 
storing the updated profile cube into the profile 

table in the data warehouse; and 
performing data staging between the profile table and 

the updated profile cube at predetermined time 

intervals . 



8. A method as in claim 2 wherein said profile cube, 

snapshot cube, and updatied profile cube each includes 
at least two dimensions and at least two levels. 



A method as in claim 8 further comprising: 
analyzing the calling pattern cube by utilizing at 
least one OLAP operation^ along more than one 
level . 



10. A method as in claim 8 further cpmprising: 

analyzing the calling pattern cube by utilizing at 
least one OLAP operation alon\f more than one 
dimension - 



11. A method as in Qlaim 2 wherein the profile cube, 

snapshot cube, ahd the updated profile cube each are 
multi-level and iftulti-dimensional cubes, 
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12. A method as in claW 2 wherein the profile table and 
the call table each has plurality of attributes, and the 
profile cube and snapshot! cube each has a plurality of 
dimensions, said attributes corresponding in a one-to-one 
fashion to the dimensions, 

13. A method as in claim 2 Wherein the profile cube 
includes at least one cell haying probability based 
values . 



14. A data processing system comprising: 

a data warehouse for storing data in a relational 

format, said data warehouse including a profile 

table and a call table; 
an OLAP server, coupled to the data warehouse, for 

providing predetermined OLaV operations; and 
a profile engine, coupled to the data warehouse for 

computing, maintaining and\ utilizing caller 

pattern cubes that represent\ caller profiles; 

wherein the caller pattern cubeV can be utilized 

to detect telecommunication frauc 
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15. A data processing system as in claim 14 further 

comprising: 

a fraud detection module for detecting 

telecommunication fraud by comparing known 
fraudulent profiles to caller pattern cubes; 
the prof ile\engine further generating a profile cube 
from information selected from the profile 
table, generating a snapshot cube, updating the 
profile cufce by merging the profile cube and the 
snapshot cube to generate an updated profile 
cube, and deriving a calling pattern cube based 
on the updated profile cube; wherein the profile 
engine is a scalable computation engine that is 
implemented by\OLAP programming supported by the 
OLAP server. 



16. A data processing system as in claim 14 further 
comprising : 

an analysis tool for usd by a data analyst to perform 
one of comparing the^ calling pattern cube to 
known fraudulent calling pattern cube and 
extracting information from the calling pattern 
cube based on selected\ dimensions, levels, and 
ad-hoc queries provided\by the data analyst. 



17. A data processing system as in\claim 14 further 
comprising : 
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a visualization tool for use by a data analyst to 
display the calling pattern cube in different 
formats, levels, and dimensions. 

18. A data processing system as in claim 14 further 
comprising : 

a data staging\tool for transferring data between the 
profile cupe stored in the OLAP server and 
profile tanle in the data warehouse at 
predetermined time intervals. 



20. A method as in claim 1 further comprising: 

utilizing an OLAPiserver to create a calling profile 
cube, updated! calling profile cubes, derive 
calling pattern cubes from the calling profile 
cube, analyzing calling pattern cubes, and 
comparing calling pattern cubes; 
wherein OLAP programming supported by the OLAP server 
provides a scalable computation engine for 
generating and processing the calling pattern 
cubes . 



22. The method of claim 28 wherein the calling profile 
cube is a multi-dimensional and a multi-level cube and 
wherein the volume-based calling pattern cubes are multi- 
dimensional and a multi-level crises, 



23. The method of claim 28 further comprising: 
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generating a volume-based calling pattern cube for 
each lindividual customer based on the multi- 
custdmer calling profile cube; 

comparing [the volume-based calling pattern cube for 
each customer to a predetermined fraudulent 
volumeV-based calling pattern; and 

when the volume-based calling pattern cube is in a 
first predetermined relationship with 
predetermined fraudulent volume-based calling 
pattern, Iperforming a first action. 

28. (New) A meqhod for detecting telecommunication 

fraud performed in a\data processing system having a data 
warehouse and an OLAP\ server , the method comprising: 

retrieving a plurality of call records from the data 
warehouse; 

generating a calliAg profile cube based on the call 
records; wherein the calling profile cube 
includes information on multiple customers; 

generating a volume-based calling pattern cube for 
each individual customer based on the multi- 
customer calling profile cube; 

generating a probabilityVbased calling pattern cube 
based on the volume-oased calling pattern cube 
for each individual customer; 

comparing the probability-based calling pattern cube 
for each customer to a' predetermined fraudulent 
probability-based calling pattern; 
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when the probability-based calling pattern cube is in 
a first predetermined relationship with 
predetermined fraudulent probability-based 
calling pattern, performing a first action. 



29. A method as in ctaim 28 wherein the step of when the 
probability-based calling pattern cube is in a first 
predetermined relationship with predetermined fraudulent 
probability-based calling pattern, performing a first 
action includes one of: 

flagging a particular caller with the probability- 
based calling pattern being analyzed as 
suspicious; 

automatically generating an alert that specifies 

callers with susnicious probability-based 

calling pattern; 
performing further investigation on callers with 

suspicious probabil Aty-based calling pattern; 
cancellation of telephone Services for callers with 

suspicious probability^-based calling pattern; 

and 

performing other appropriate Vemedial actions. 

30. (New) The method of claim 29 wherein the 
probability-based calling patterns \ enables one of the 
analysis and comparison of a first probability-based 
calling patterns that covers a first Ytime period with a 
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